ByteOS Network

Vulnerability Details :

CVE-2021-3737

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-04 Mar, 2022 | 00:00

Updated At-03 Aug, 2024 | 17:01

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:04 Mar, 2022 | 00:00

Updated At:03 Aug, 2024 | 17:01

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

python

Versions

Affected

Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2

Problem Types

Type	CWE ID	Description
CWE	CWE-835	CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop'), CWE-400 - Uncontrolled Resource Consumption

Type: CWE

CWE ID: CWE-835

Description: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop'), CWE-400 - Uncontrolled Resource Consumption

References

Hyperlink	Resource
https://bugs.python.org/issue44022	N/A
https://github.com/python/cpython/pull/25916	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=1995162	N/A
https://github.com/python/cpython/pull/26503	N/A
https://ubuntu.com/security/CVE-2021-3737	N/A
https://www.oracle.com/security-alerts/cpujul2022.html	N/A
https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html	N/A
https://security.netapp.com/advisory/ntap-20220407-0009/	N/A
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html	mailing-list
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html	mailing-list

Hyperlink: https://bugs.python.org/issue44022

Resource: N/A

Hyperlink: https://github.com/python/cpython/pull/25916

Resource: N/A

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1995162

Resource: N/A

Hyperlink: https://github.com/python/cpython/pull/26503

Resource: N/A

Hyperlink: https://ubuntu.com/security/CVE-2021-3737

Resource: N/A

Hyperlink: https://www.oracle.com/security-alerts/cpujul2022.html

Resource: N/A

Hyperlink: https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html

Resource: N/A

Hyperlink: https://security.netapp.com/advisory/ntap-20220407-0009/

Resource: N/A

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Resource:

mailing-list

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html

Resource:

mailing-list

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://bugs.python.org/issue44022	x_transferred
https://github.com/python/cpython/pull/25916	x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1995162	x_transferred
https://github.com/python/cpython/pull/26503	x_transferred
https://ubuntu.com/security/CVE-2021-3737	x_transferred
https://www.oracle.com/security-alerts/cpujul2022.html	x_transferred
https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html	x_transferred
https://security.netapp.com/advisory/ntap-20220407-0009/	x_transferred
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html	mailing-list x_transferred
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html	mailing-list x_transferred

Hyperlink: https://bugs.python.org/issue44022

Resource:

x_transferred

Hyperlink: https://github.com/python/cpython/pull/25916

Resource:

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1995162

Resource:

x_transferred

Hyperlink: https://github.com/python/cpython/pull/26503

Resource:

x_transferred

Hyperlink: https://ubuntu.com/security/CVE-2021-3737

Resource:

x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujul2022.html

Resource:

x_transferred

Hyperlink: https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html

Resource:

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20220407-0009/

Resource:

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Resource:

mailing-list

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html

Resource:

mailing-list

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:04 Mar, 2022 | 19:15

Updated At:07 Nov, 2023 | 03:38

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	7.1	HIGH	AV:N/AC:M/Au:N/C:N/I:N/A:C

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 7.1

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:N/I:N/A:C

CPE Matches

Python Software Foundation

>>python>>Versions from 3.6.0(inclusive) to 3.6.14(exclusive)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Python Software Foundation

>>python>>Versions from 3.7.0(inclusive) to 3.7.11(exclusive)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Python Software Foundation

>>python>>Versions from 3.8.0(inclusive) to 3.8.11(exclusive)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Python Software Foundation

>>python>>Versions from 3.9.0(inclusive) to 3.9.6(exclusive)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>codeready_linux_builder>>8.0

cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>codeready_linux_builder_for_ibm_z_systems>>8.0

cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>codeready_linux_builder_for_power_little_endian>>8.0

cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux>>6.0

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux>>7.0

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux>>8.0

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_for_ibm_z_systems>>8.0

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_for_power_little_endian>>8.0

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>33

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Fedora Project

>>fedora>>34

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>14.04

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

Canonical Ltd.

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

Canonical Ltd.

>>ubuntu_linux>>18.04

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>20.04

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>21.04

cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*

NetApp, Inc.

>>hci>>-

cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*

NetApp, Inc.

>>management_services_for_element_software>>-

cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*

NetApp, Inc.

>>netapp_xcp_smb>>-

cpe:2.3:a:netapp:netapp_xcp_smb:-:*:*:*:*:*:*:*

NetApp, Inc.

>>ontap_select_deploy_administration_utility>>-

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

NetApp, Inc.

>>xcp_nfs>>-

cpe:2.3:a:netapp:xcp_nfs:-:*:*:*:*:*:*:*

Oracle Corporation

>>communications_cloud_native_core_binding_support_function>>22.1.3

cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*

Oracle Corporation

>>communications_cloud_native_core_network_exposure_function>>22.1.1

cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*

Oracle Corporation

>>communications_cloud_native_core_policy>>22.2.0

cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Primary	nvd@nist.gov
CWE-835	Primary	nvd@nist.gov
CWE-835	Secondary	secalert@redhat.com

CWE ID: CWE-400

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-835

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-835

Type: Secondary